CVE-2025-22912
Published: 16 January 2025
Summary
CVE-2025-22912 is a critical-severity Command Injection (CWE-77) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection vulnerability by validating and sanitizing user inputs to the /goform/formAccept component against whitelists or expected patterns.
Requires timely identification, reporting, and patching of the specific command injection flaw in RE11S v1.11 firmware to eliminate the vulnerability.
Mitigates remote unauthenticated exploitation by monitoring and controlling network communications to the vulnerable /goform/formAccept endpoint at system boundaries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated command injection in public-facing web component (/goform/formAccept) enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution on the embedded device.
NVD Description
RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.
Deeper analysisAI
CVE-2025-22912, published on 2025-01-16, is a command injection vulnerability (CWE-77) in RE11S version 1.11, specifically via the /goform/formAccept component. The flaw carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and high potential impact on confidentiality, integrity, and availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network by sending crafted requests to the affected component, enabling arbitrary command injection and execution on the target system. Exploitation requires no prior access or user involvement, potentially allowing full remote code execution and system compromise.
Mitigation details are available in advisories and resources linked from http://re11s.com, https://github.com/xyqer1/RE11S_1.11-formAccept-CommandInjection, and https://www.edimax.com/edimax/global/. Security practitioners should consult these references for vendor patches, workarounds, or updated firmware for RE11S devices.
Details
- CWE(s)